You will notice that the code defines
lanes as simple-bit-vectors,
and there is no interpretation of these lanes as numbers in any sense.
Hence endianness troubles
are eliminated, at the cost of a linear-time vector rotation2 .

A second file contains a few goodies, including methods for converting
integers to lanes (little-endian) and back again, and methods for
visualizing the Keccak state:

(Note that Diana's states are transposes of mine, as she chose to use the
y coordinate as the row index when printing). The careful reader will
notice that my implementation is failing on rho of row 1; for instance,
the (0,0) coordinate is set from 1 to 0, which is in clear violation
of the reference. Well, I haven't figured out where my rho is going wrong.
Perhaps you, reader, would lend a hand?

Edit: After discovering the problem in rho (no initial assignment of A[0][0] = a[0][0]) and also discovering a problem with pi (mixing up the X and Y with x and y), cl-keccak now exactly aligns with the Eucrypt test vectors! On to the sponge construction!

meaning that transparency, correctness, and clarity of purpose are held above all else. [↩]